Forwarded Taiwan Computer Network Crisis Coordination Center Cybersecurity Information Alert TWCERTCC-200-202610-00000018

[Description]
Fortinet has released a critical security vulnerability advisory (CVE-2025-46773, CVSS: 8.8) for FortiAnalyzer, FortiManager, FortiManager Cloud, and FortiAnalyzer Cloud. This is an SQL injection vulnerability that, due to improper handling of special elements, may allow low-privileged users to execute arbitrary commands through carefully crafted requests.

[Affected Platforms]
FortiAnalyzer versions 7.6.0 to 7.6.4, FortiAnalyzer versions 7.4.0 to 7.4.7, FortiAnalyzer version 7.2, FortiAnalyzer Cloud versions 7.62 to 7.6.4, FortiAnalyzer Cloud versions 7.4.1 to 7.4.7, FortiAnalyzer Cloud versions 7.2.1 to 7.2.11, FortiManager versions 7.6.0 to 7.6.4, FortiManager versions 7.4.0 to 7.4.6, FortiManager version 7.2, FortiManager Cloud versions 7.6.2 to 7.6.4

[Recommended Measures]
Please update to the following versions: FortiAnalyzer version 7.6.5, FortiAnalyzer version 7.4.8, FortiAnalyzer Cloud version 7.6.5, FortiAnalyzer Cloud version 7.4.8, FortiAnalyzer Cloud version 7.2.12, FortiManager version 7.6.5, FortiManager version 7.4.7, FortiManager Cloud version 7.6.5

[References]
1. https://www.twcert.org.tw/tw/cp-169-11282-d479f-1.html